APT24 is associated with intrusion activity that uses phishing, malware delivery, persistence and covert communication to maintain access. Defenders should look for suspicious documents, unusual process launches, network beacons and account misuse. Controls that reduce execution from email, restrict admin rights and surface anomalous outbound traffic make these techniques harder to sustain.
How APT24 typically gets in and stays in
APT24’s playbook is consistent with a long-running intrusion set that relies on initial access through phishing, then follows with malware delivery and follow-on persistence. The practical issue is not just the first click, but whether the operator can keep a foothold long enough to move quietly, re-enter, and blend into ordinary user activity.
That means defenders should think in stages: lure delivery, execution, post-compromise control, and covert communications. For a broader map of how threat actor naming, clustering and group-level intelligence are used in practice, the Threat Actor Groups Guide is the right starting point.
Phishing matters here because it creates a delivery path for the payload, and the payload’s value depends on whether endpoint controls, attachment handling and user permissions let it run. If execution is easy and outbound traffic is unconstrained, the intrusion can transition from a single malicious message into a durable access path.
APT24 also illustrates why covert communication is a tactic, not just a detail. Once malware is established, periodic outbound beacons, proxy use or other low-and-slow network behaviour can keep command and control available without standing out as an obvious burst of malicious traffic.
What defenders should watch for in an APT24 intrusion chain
The most useful way to interpret APT24’s tactics and techniques is to break them into observable behaviours rather than treat the group name as the key clue. Suspicious documents, unexpected process launches, account misuse and repetitive outbound connections are stronger operational signals than any one filename or hash.
That focus also helps separate pre-compromise from post-compromise activity. A malicious document may be the entry point, but persistence and covert communications are what usually extend dwell time and create the chance for lateral movement, collection or repeat access.
The phishing stage deserves particular attention because it often exposes the whole chain. The Top 10 Phishing Techniques page is useful when you want to distinguish attachment-based lures, credential theft and other delivery patterns from the later malware and beaconing phases.
From a defender’s perspective, the important question is which stage failed to be blocked. If email filtering missed the lure, application control was weak, or user rights were too broad, the intrusion has room to progress from deception to execution to persistence.
Which ATT&CK-style techniques this pattern usually maps to
APT24’s behaviours line up with common intrusion techniques such as phishing, malware execution, persistence and command-and-control communication. That is useful because it turns a threat name into a huntable sequence: initial access, execution, persistence, and network activity that supports continued operator control.
The most practical mapping exercise is to ask whether the environment shows evidence of document-triggered execution, scheduled or registry-based persistence, and outbound network activity that does not match normal business applications. Those are the behaviours that usually matter when a group is described as using phishing and covert communications.
The MITRE ATT&CK Enterprise Matrix is the most direct external reference for converting those behaviours into hunt hypotheses, detection content and response triage. If you want to pair the offensive view with countermeasure ideas, the MITRE D3FEND knowledge base is a useful complement.
When defenders translate APT24 activity into technique-level detections, they can build alerts around process ancestry, suspicious parent-child process relationships, script or document-based launches, and recurring beacon patterns rather than waiting for a known bad indicator to appear.
Risk and Threat Considerations
APT24’s main risk is that a successful phishing entry point can become a sustained operator-controlled foothold. If the environment allows local privilege misuse, permissive outbound connectivity or weak visibility into process creation, the group can keep access while staying below the threshold of obvious alarm.
Failure mechanism: a deceptive message triggers execution, followed by persistence and covert communication that lets the attacker retain access while blending into normal user and network activity.
Impact: longer dwell time, better chances of credential misuse or internal discovery, and a harder cleanup because the defender must remove both the initial malware and any surviving foothold.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | APT24 uses phishing as an initial access technique. |
| T1053 — Scheduled Task/Job | Persistence is a key part of the intrusion chain described. | |
| T1071 — Application Layer Protocol | Covert communication often uses normal-looking network protocols. | |
| Recommendation — Map lure and attachment telemetry to T1566 and block delivery paths that reach users. Hunt for persistence mechanisms such as scheduled tasks that keep malware resident. Inspect outbound traffic for beaconing and other command-and-control patterns. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Restricting admin rights reduces the impact of malware execution and follow-on abuse. |
| SI-4 — System Monitoring | Detection depends on spotting suspicious process launches and outbound beacons. | |
| Recommendation — Enforce least privilege so a phishing-based foothold cannot gain broad execution authority. Use monitoring to surface anomalous processes and network activity tied to intrusion chains. | ||
Practitioner Guidance
What to verify: Check whether suspicious document opens are followed by unusual child processes, script interpreters or network connections. If those three signals line up, treat the event as an intrusion chain rather than an isolated phishing attempt.
What to prioritise: Reduce the attacker’s room to persist by tightening email execution paths, limiting admin rights and watching for outbound traffic that is periodic, low-volume or destination-stable. Those controls directly affect the techniques described in this case.
Practitioner takeaway: The key judgement is to hunt for the sequence, not the single indicator, because APT24 becomes materially more dangerous once phishing turns into sustained covert access.